T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:18
- Finding
- Unpinned Third-Party Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 18–25 **Vulnerability Type**: Unpinned third-party dependencies executed from a remote package registry **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @wavespeed/cli wavespeed login # opens https://wavespeed.ai/accesskey and stores the key wavespeed status # confirms you are signed in ``` ```markdown Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login. ``` ### Technical Analysis The skill instructs users or agents to install and execute `@wavespeed/cli` and `@wavespeed/mcp` without pinning either package to a reviewed version. Consequently, the effective code retrieved from the package registry can change after the skill has been audited. The `npx -y @wavespeed/mcp` command is especially sensitive because it automatically accepts installation and immediately executes the resolved package. The global CLI installation may also run package lifecycle scripts and makes the installed command available across the user environment. No package version, lockfile, checksum, signature, or other integrity constraint is specified. This creates a supply-chain exposure rather than evidence that the currently named packages are malicious. ### Attack Path 1. An attacker compromises the package publisher account, release process, or registry distribution channel. 2. The attacker publishes a malicious version under one of the referenced package names. 3. A user or agent follows the skill and runs the unpinned `npm install -g` or `npx -y` command. 4. The package manager resolves the attacker-controlled release because no exact version or integrity value is required. 5. Installation lifecycle code or the MCP server executes with the invokin ...[truncated 773 chars]
- Remediation
- ## Remediation Suggestions - Pin both packages to exact, reviewed versions, for example `@wavespeed/cli@X.Y.Z` and `@wavespeed/mcp@X.Y.Z`. - Record and verify package integrity hashes or signatures through a lockfile, trusted package bundle, or equivalent reproducible dependency mechanism. - Avoid global installation where practical; use a project-scoped, isolated environment with minimal filesystem and credential access. - Remove `-y` from the `npx` command so package installation and execution require explicit confirmation. - Disable or strictly control npm lifecycle scripts where operationally possible. - Review new package versions before updating the documented pins. - Run the MCP process with least privilege and prevent it from accessing unrelated credentials and files. - Document the expected publisher, registry, version, and provenance so users can detect substituted packages.